RLE NOVA PlanManager Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in RLE NOVA's PlanManager. This issue allows attackers to execute JavaScript in the context of the victim's browser by injecting malicious payloads through the 'comment' and 'brand' parameters on '/index.php'. The application stores these payloads and displays them to other users without adequate sanitization. Exploitation of this vulnerability could lead to the theft of sensitive user information, such as session cookies, or allow attackers to perform actions on behalf of the user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected content.